CVE-2020-16154
published 2021-12-13CVE-2020-16154: The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
PriorityP434high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.71%
49.5th percentile
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | cpanminus | < cpanminus 1.7045-1 (bookworm) | cpanminus 1.7045-1 (bookworm) |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
App::cpanminus vulnerability
vendor_ubuntu·2022-01-24
CVE-2020-16154 App::cpanminus vulnerability
Title: App::cpanminus vulnerability
Summary: App::cpanminus could be made to bypass signature verification
if it received specially crafted input.
It was discovered that App::cpanminus did not properly verify CHECKSUMS files.
An attacker could possibly use this issue to bypass signature verification,
gaining access to sensitive data or possibly executing unauthorized code.
Instructions: After a standard system update, configure App::cpanminus to use only trusted
CPAN mirrors over HTTPS using the option on the command line or
environment variable.
Red Hat
perl-App-cpanminus: Bypass of verification of signatures in CHECKSUMS files
vendor_redhat·2021-11-23·CVSS 7.8
CVE-2020-16154 [HIGH] CWE-347 perl-App-cpanminus: Bypass of verification of signatures in CHECKSUMS files
perl-App-cpanminus: Bypass of verification of signatures in CHECKSUMS files
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
A flaw was found in the way the perl-App-cpanminus performed verification of package signatures stored in CHECKSUMS files. A malicious or compromised CPAN server used by a user, or a man-in-the-middle attacker, could use this flaw to bypass signature verification.
Mitigation: This issue can be mitigated by instructing perl-App-cpanminus to only use trusted CPAN mirrors (www.cpan.org or cpan.metacpan.org) and use HTTPS for communication with CPAN servers. The `cpanm` command can be configured to use the specific CPAN mirror using the --from command line option by running it as:
```
cpanm --from https://www.cpan.org ...
```
You can al
Debian
CVE-2020-16154: cpanminus - The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
vendor_debian·2020·CVSS 7.8
CVE-2020-16154 [HIGH] CVE-2020-16154: cpanminus - The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
Scope: local
bookworm: resolved (fixed in 1.7045-1)
bullseye: open
forky: resolved (fixed in 1.7045-1)
sid: resolved (fixed in 1.7045-1)
trixie: resolved (fixed in 1.7045-1)
GHSA
GHSA-m92x-373g-xc36: The App::cpanminus package 1
ghsa_unreviewed·2022-02-10
CVE-2020-16154 [HIGH] CWE-347 GHSA-m92x-373g-xc36: The App::cpanminus package 1
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
OSV
CVE-2020-16154: The App::cpanminus package 1
osv·2021-12-13·CVSS 7.8
CVE-2020-16154 [HIGH] CVE-2020-16154: The App::cpanminus package 1
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DENFY4CRTIZL5WYYUYUM4VKCJNXO4QIW/https://metacpan.org/pod/App::cpanminushttps://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DENFY4CRTIZL5WYYUYUM4VKCJNXO4QIW/https://metacpan.org/pod/App::cpanminus
2021-12-13
Published